CVE-2026-88920
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 4.0.2, 3.0.6, 2.4.4
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP messages via a crafted unsigned SAML sender-vouches assertion containing an attacker-controlled key. Users are recommended to upgrade to versions 4.0.2 or 3.0.6 or 2.4.4, which fix this issue.
Affected versions
- org.apache.wss4j:wss4j-ws-security-dom
From 4.0.0 · fixed in 4.0.2; From 3.0.0 · fixed in 3.0.6; fixed in 2.4.4